Rote - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/rote/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:08:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRote: Privilege Escalation via JWT Secret Exposure (CVE-2026-126803)https://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/Wed, 11 Nov 2026 22:08:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rote-privilege-escalation-cve-2026-126803/Rote versions up to 2.6.0 contain a privilege escalation vulnerability that allows an authenticated administrator to forge JWT tokens by accessing the application's signing secret via the settings API.Rote versions up to and including 2.6.0 contain a privilege escalation vulnerability in the administrative settings endpoint. An authenticated administrator can retrieve the unmasked jwtSecret or overwrite it by making requests to the /v2/api/admin/settings endpoint. This allows an attacker to obtain the signing key, forge HS256 JWT tokens for super administrator accounts, and subsequently escalate privileges to modify user roles across the platform.

Impact

Successful exploitation allows an authenticated administrator to escalate their privileges to a super administrator role. This grants the attacker full control over user roles and administrative configurations within the Rote platform.

Recommendation

  • Update Rote to a patched version beyond 2.6.0 immediately to remediate CVE-2026-126803.
  • Audit logs for administrative access to the /v2/api/admin/settings endpoint for anomalous patterns or unauthorized changes.
]]>highadvisorycve-2026-126803privilege-escalationweb-application-vulnerabilityRote: Authorization bypass in OAuth bind/merge endpoint (CVE-2026-126801)https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/Wed, 11 Nov 2026 22:08:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint that allows authenticated attackers to hijack, manipulate, and delete arbitrary user accounts.Rote versions 1.2.0 through 2.6.0 contain an authorization bypass vulnerability in the OAuth bind/merge endpoint (CVE-2026-126801). The vulnerability allows an authenticated attacker to merge any OAuth-bound account into their own by submitting a public 'existingUserId' along with a target GitHub or Apple user ID. Successful exploitation grants the attacker full access to the victim's notes, attachments, and API keys, and permits the deletion of the victim's account.

Impact

Successful exploitation results in full account takeover, unauthorized access to sensitive user data, and the potential for account destruction. The CVSS 3.1 base score is 8.8.

Recommendation

Update Rote instances to a version later than 2.6.0. Organizations should audit OAuth integration logs for anomalous merge activity or unexpected 'existingUserId' values in bind requests until the patch is applied.

]]>highadvisory